aws-kinesis-agent-latest.amzn1.noarch.rpm is a vulnerable version about amazon-kinesis-agent

[vgottardi2]

According to AWS support ticket, new build is available at https://s3.amazonaws.com/streaming-data-agent/aws-kinesis-agent-latest.amzn2.noarch.rpm (with amzn2 instead of amzn1).

$ rpm -qip aws-kinesis-agent-latest.amzn2.noarch.rpm
Name        : aws-kinesis-agent
Version     : 2.0.4
Release     : 1.amzn2
Architecture: noarch
Install Date: (not installed)
Group       : Applications/Communications
Size        : 25523949
License     : Amazon Software License and Apache 2.0 and MIT
Signature   : (none)
Source RPM  : aws-kinesis-agent-2.0.4-1.amzn2.src.rpm
Build Date  : Wed 15 Dec 2021 03:18:21 AM UTC
Build Host  : build.amazon.com
Relocations : (not relocatable)
Packager    : Amazon Linux
Vendor      : Amazon Linux
URL         : http://aws.amazon.com/
Summary     : Amazon Kinesis Streaming Data Agent
Description :
aws-kinesis-agent is a software service that runs on customer hosts and continuously monitors a set of log files
and sends new data to the Amazon Kinesis Stream service and Amazon Kinesis Firehose service in near-real-time.

[mechie]

Thanks for the update, just confirmed it myself. The documentation still points to the 1.1.6 amzn1 package, so that needs to be updated to avoid leading new users to install a vulnerable version, but glad to see an up-to-date RPM package is available 😄

[mechie]

At some point in 2022 or 2023, the docs were updated to point to the amzn2 package. Closing as completed.